With the wide use of the Internet, cyberattacks including DDoS attacks and transmission, of spam mails are surging. Most of these attacks result from malicious software called malware. Attackers infect terminals and servers of general users with malware, control the terminals and servers unauthorizedly by operating the malware, and implement information collecting and new attacks. These attacks have been a social problem in recent years. For this reason, measures against cyberattacks based on malware infection are urgently needed.
Measures implemented in terminals and measures implemented in networks are used as measures against cyberattacks. Methods using anti-virus software and methods using a host-based IDS (Instruction Detection System) or a host-based IPS (Instruction Prevention System) are used as measures implemented in terminals. In these methods, software is installed in terminals to implement measures.
On the other hand, methods using a network-based IDS or a network-based IPS, a FW (Firewall) or a WAF (web Application Firewall) are used as measures implemented in networks. In these methods, an examination device is arranged on a communication path in a network. For example, a method of examining communication of DNS queries and DNS responses at a site on the communication path in the network where communication with a DNS server can be monitored has been proposed (for example, see Non Patent Literature 1 or 2). Furthermore, in recent years, SIEM (Security Information and Event Management) services in which logs of terminals and devices are analyzed to find traces of attacks, etc., have been implemented.
In those methods, communication partners of and the communication content of malware infection attacks and other cyberattacks are collected in a decoy system referred to as honey pot. Furthermore, information about communications relevant to attacks is collected in a way that, by using a malware analysis system referred as a sandbox, malware is caused to run actually and partners and the content of communications by malware are collected and in a way that partners and the content of communications that are determined as attacks by a spam mail countermeasure system or a DDoS countermeasure system are collected.
For example, the IP addresses of the communication partners with respect to the collected attacks are blacklisted and communications with the IP addresses are determined as attacks. The information to be blacklisted may be uniform resource locators (URLs) or domain names. In this case, URLs or domain names may be blacklisted by regular expressions.
In general, when traffic logs and alerts are collected from different devices and software and information about communication partners and the content of communication are extracted, notations of items may foe different depending on devices and software. In recent years, a technology of converting sets of log information represented by different notations into a uniform notation for tallying has been widely used as SIEM products.